// https://syzkaller.appspot.com/bug?id=d0d8879a66b36bd60a0d815b7755e558a9afc82f // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; memcpy((void*)0x20000480, "/dev/sequencer\000", 15); syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000480ul, /*flags=O_EXCL|O_RDWR*/ 0x82ul, /*mode=*/0ul); memcpy((void*)0x20000180, "/dev/audio\000", 11); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000180ul, /*flags=O_SYNC|O_NONBLOCK|O_LARGEFILE|O_CREAT|O_RDWR*/ 0x109842ul, /*mode=*/0ul); if (res != -1) r[0] = res; memcpy((void*)0x200001c0, "\xd1\xd6\x69\xc1\x0a\xb1\x0d\xe4\xd9\xf6\x67\xfc\x4a\x29\x9c\x79\x4e" "\x7d\x7f\x10\xe7\xbc\xd8\x21\xa5\x8b\x56\x32\x57\x99\x80\x27\x50\x0b" "\x36\xcc\x01\x3c\x52\x49\x3a\x88\x66\xd3\xe9\xc6\x47\xab\x77\x64\x72" "\x97\x02\x3c\xfc\xb4\x4f\x10\x93\x9f\x19\xab\xcb\x89\x8f\xa8\x9f\xf0" "\x6d\xc0\xbb\xd7\x4b\x64\x97\x82\x76\x05\x55\x66\xdb\x53\x46\x45\x7c" "\x5c\x66\xf2\x86\x06\xda\xd3\x7b\x63\x53\xa8", 96); syscall(__NR_write, /*fd=*/r[0], /*data=*/0x200001c0ul, /*len=*/0x60ul); return 0; }